Information Management Assessment

Action plan progress review

HM Treasury

Reviewed May 2017

Published August 2017

Working with government to raise standards in information management Background

The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The HM Treasury (HMT) IMA took place in September 2015. This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed under ‘Next Steps.’

Action plan development

HMT produced a detailed action plan, and progress on this was reported to its Operational Risk Group. The National Archives formally assessed progress against the action plan in September 2016. The IMA report and action plan are both published on The National Archives’ website.¹

¹ [http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/](http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/) Executive summary

Value of information

- We are pleased to note that HM Treasury (HMT) has made significant progress in improving its approach to information asset management and is now working to embed its governance approach across the department.

- HMT has maintained a good level of senior engagement with knowledge and information management and continues to promote the value of information across the organisation.

- We particularly commend the work around behavioural change and improving information and records management culture within HMT. This work has been used as a case study as part of the cross-government Behavioural Insights Toolkit.

Digital information and supporting technology

- HMT continues to lead the way in government in its approach to implementing a system for managing digital information throughout its lifecycle.

Information risk, governance and oversight

- HMT has taken steps to raise awareness of information risk through regular briefings at a senior level and by reviewing related policies. It needs to continue to promote a better understanding of information and records management risks through policies, guidance and training and to log these risks across HMT and identify appropriate mitigations.

- In recognition of the crucial role it plays in ensuring the successful use of Info Store in business areas, HMT has streamlined the Site Owner network and provides training, guidance and online forums to support it in its work.

- The approach taken by HMT to monitor compliance with information and records management policy continues to be exemplary. The Knowledge Management Benchmarking process has been enhanced by the inclusion of management information on use of Info Store in order to ensure that staff use corporate systems to manage digital information and records appropriately.

Records review and transfer

- HMT has made significant progress in appraising and selecting digital information, starting with the Panagon collection (1996-2004). It has also set up processes for the review and disposal of digital information from 2005 onwards. Working in conjunction with The National Archives, HMT now needs to confirm selection, establish a process for sensitivity review and transfer its earliest digital records to The National Archives.

- HMT is making progress with appraisal, selection and transfer of legacy paper records. It needs to continue to invest time and effort in this work to keep pace with the agreed plan to review these records and progress towards compliance with the 20 Year Rule.

Progress to address recommendations and risk areas

1 The value of information

| Performance rating | IMA 2015 | Review 2017 | |--------------------|----------------|-------------| | Communicating and realising value | Good practice | Good practice | | Managing information as an asset | Development needed | Satisfactory |

Situation at the time of the IMA

Senior engagement with Knowledge and Information Management (KIM) was among the best we had seen in government. HMT had a clear strategy for improving information and records management.

HMT needed to further develop its approach to information asset management in order to gain greater control of its information assets.

- Following the arrival of a new Permanent Secretary and Second Permanent Secretary in 2016 and a review of senior responsibilities, the Senior KIM Champion role is now held by the Director of Corporate Services. The Director is a member of Executive Management Board.

- The new Second Permanent Secretary presented the annual awards for Knowledge Management (KM) Benchmarking in spring 2017 which demonstrates continuing senior buy-in for this important work.

- HMT has developed a Behaviour Change Strategy to encourage users to improve their approach to record keeping and the use of Info Store. This has included the use of videos of users talking about their record keeping experiences and articles on historical records at HMT.

- A new role of Information Assurance Manager has been created. The successful candidate joined HMT in November 2016 and has taken part in The National Archives’ ‘train the trainer’ workshop for Information Asset Owners (IAO).

- Information policy guidance on the HMT intranet has been updated and now clearly sets out the role and responsibilities of the IAO and includes a definition of an information asset.

- The Information Assurance Manager is meeting with IAOs individually and going through a questionnaire which covers responsibilities, the information assets held in their area and whether they have completed IAO training. The majority of IAOs have taken part though some are still yet to engage. See next steps

- HMT has developed a new information asset register template. This includes information on retention and whether it would be required for The National Archives. See next steps

- The KM Benchmarking has been revised to better enable business areas to report on the assurance of their information assets (see section 3).

2 Digital information and supporting technology

| Performance rating | IMA 2015 | Review 2017 | |--------------------|----------------|-------------| | Supporting information through technology | Satisfactory | Good practice | | Digital continuity and IT change | Satisfactory | Satisfactory |

Situation at the time of the IMA

HMT had made good progress in putting in place a system – Info Store (based on SharePoint 2010) – to manage its digital information.

Although Info Store did not have the capability for full lifecycle management of records, HMT had set up the Information Management Project to address this.

- The Information Management project is now complete and Info Store is fully operational, with plug-ins (SyncPoint, Compliance Extender, Metalogix and Cardio Log) to enable full records management. HMT has enhanced the search functionality by including filter options on the left hand side – a simple and effective way of making it easier for staff to use.
- A Records Centre service has now been implemented within Info Store to enable archiving and review. See also section 4
- Shared drive users were identified and relevant content mapped and then migrated to Info Store between May and September 2016. Some staff are permitted to use shared drives for particular documents such as linked spreadsheets – this is closely monitored by the KIM team. No new shared areas are being set up.
- HMT has established monthly reporting to track records storage and quality – this feeds into the KM Benchmarking. See section 3
- HMT produces a report on the top 100 mailboxes, which is published on the intranet. Members of the KIM team also sit down with staff members with large inboxes and help them to manage their emails.
- Staff are encouraged to complete a course on smarter working with Outlook to help them manage their inboxes.
- Personal drives are in use and at present are not officially monitored (however, it is HMT policy to delete these when staff leave the organisation). See next steps 3 Information risk, governance and oversight

| Performance rating | IMA 2015 | Review 2017 | |--------------------|-------------------|---------------------------------| | Recognising information risk | Development needed | Progressing towards satisfactory | | Establishing control | Satisfactory | Good practice | | Providing guidance | Good practice | Good practice | | Measuring impact | Good practice | Best practice |

Situation at the time of the IMA

HMT had recently updated its Records Management Policy and related guidance and had developed an innovative and effective approach to monitoring KIM compliance via its annual KM Benchmarking.

HMT had established an Information Management steering group to facilitate joined-up working and networks of KIM Champions and Site Owners had been established to support information and records management in business areas.

HMT needed to do more to embed information risk within its risk management framework and increase awareness of information and records management risks.

- A Board briefing took place in March 2016 on information assurance and cyber security and there has been continuing engagement with Executive Management Board and SCS communications to raise awareness of information risk. Routine reporting has been established with quarterly sessions scheduled with the SIRO and monthly reports to the Operational Risk Group.
- Information security and risk policies have been reviewed and redrafted as part of the wider comprehensive policy consolidation exercise. HMT needs to continue to promote a better understanding of information and records management risks and ensure that these are logged and appropriate mitigations identified. See next steps
- The network of Site Owners has been reviewed and reduced to a more focussed, manageable group; HMT has focussed on upskilling these staff. A two hour training session is provided for Site Owners and there is also a monthly forum and an online space for news, guidance and discussions.
- Deputy Director level KIM Champions have responsibility for records management in their business area, for promoting good practice and tackling poor performance. The HMT Retention and Deletion Policy has now been published on GOV.UK, in line with Sir Alex Allan’s recommendation.

The KM Benchmarking has been further developed to use management information (extracted, in part, from Info Store) to measure records management practice in business areas from both a quantitative and qualitative perspective. Monthly dashboards are produced for KIM Champions that focus on record keeping, and quarterly reports are sent to leadership teams to ensure they are driving the right messages. Business areas are measured on what they are filing, edits, filing of emails, filing time, access management and file naming. This information is incorporated in the annual benchmarking and prizes are given for the best performing business areas. HMT would now like to include personal drive use in this monitoring. See next steps

4 Records, review and transfer

| Performance rating | IMA 2015 | Review 2017 | |-------------------------------------|----------------|---------------| | Oversight of records and selection | Satisfactory | Good practice | | Implementing disposal decisions | Development needed | Satisfactory |

Situation at the time of the IMA

HMT needed to develop an approach to appraisal, selection, sensitivity review and transfer of its digital information as well as continuing to progress with reviewing paper records in order to transition to the 20-year rule.

- Legacy digital records from 1996-2004 have now been appraised, listed on a digital SLAQ spreadsheet and records of historical value identified. This now needs to be signed off by The National Archives. See next steps

- HMT is now exploring how it will sensitivity review these legacy digital records. The first step has been to find a software tool to enable HMT to securely share digital records with other government departments in order to consult regarding sensitivity – HMT is currently discussing the possibility of using Cavarta for this. See next steps

- A process has been established for closing and archiving files on Info Store. For content created after 2015 a two step process has been established with files first closed, and then archived, into the information management area. This can be done manually or automatically after a set period of time. Once records are in the information management area the records management team will review them within ten years.

- HMT continues to make progress in reducing its backlog of legacy paper records, working closely with its third party supplier (Iron Mountain) and The National Archives. An Accelerated Transfer Programme Board meets monthly to keep track of this work and discuss any issues that may arise. Iron Mountain track all activities such as sensitivity review and provide statistics to HMT so they can monitor progress.

- HMT has revisited the Advisory Council to report on progress with appraisal, selection, sensitivity review and transfer of its legacy paper records and to refresh the Retention Instrument to ensure that legal cover is in place for these legacy records. See next steps

- Resource has been dedicated to processing records requisitioned from The National Archives and developing a method of tracking these. Work is underway to confirm records that are ‘misplaced in department’ and for the return of non-sensitive files to The National Archives, as well as planning for the review of sensitive files. See next steps Next Steps

The National Archives will continue to support HM Treasury (HMT) in its work on information and records management. Outstanding recommendations will be reviewed at the time of the department’s IMA reassessment. It is recommended that HMT focusses on the following:

- Embed the process for completing Information Asset Registers.
- Ensure that Information Asset Owners who have not yet met with the Information Assurance Manager do so.
- Build monitoring of personal drive use into monthly reporting and Knowledge Management benchmarking.
- Continue to promote a better understanding of information and records management risks through policies, guidance and training; for example, HMT could include a definition as part of the high level information policy guidance on the intranet.
- Recognise and log information and records management risks and identify appropriate mitigations.
- Working in conjunction with The National Archives, confirm selection and ensure that legacy digital records from 1996-2004 are sensitivity reviewed and progressed to digital transfer.
- Continue to keep pace with the agreed plan to review and transfer legacy paper records and progress towards compliance.
- Ensure misplaced records are declared and continue the good work in returning non-sensitive items and to plan for review of sensitive files.